Malware analysis method, malware analysis device, and malware analysis system

Abstract

A malware analysis deviceincludes: a dynamic analysis unitwhich performs dynamic analysis of malware; a communication determination unitwhich determines whether communication by the malware occurs when the dynamic analysis unitperforms dynamic analysis; a static analysis requesting unitwhich suspends communication when the communication determination unitdetermines that the communication by the malware occurs to present a request to perform static analysis; and a setting changing unitwhich sets a device as a communication destination of the malware to make a response obtained by the static analysis as being expected by the malware.